Environment Variables

Environment Files

Local development reads .env.local.

Deploy-oriented service connection commands such as ./coremvp connect supabase write production-ready values to .env.

Never commit .env or .env.local to version control. They are already in .gitignore.

Required Variables

Prop

Type

Optional Variables

Prop

Type

Development Configuration

.env.local

# App
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Supabase (from `bunx supabase status`)
NEXT_PUBLIC_SUPABASE_URL=http://127.0.0.1:54321
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Postgres app data
DATABASE_URL=postgresql://postgres:<password>@127.0.0.1:54322/postgres

# Stripe (test keys)
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...

# Optional
GOOGLE_API_KEY=your-google-api-key
EMAIL_DELIVERY_MODE=mock

Production Configuration

.env (production)

# App
NEXT_PUBLIC_APP_URL=https://yourdomain.com

# Supabase (from Supabase Dashboard)
NEXT_PUBLIC_SUPABASE_URL=https://xxx.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...

# Postgres app data (Supavisor transaction pooler for serverless runtimes)
DATABASE_URL=postgresql://postgres.xxx:[password]@aws-0-us-east-1.pooler.supabase.com:6543/postgres?sslmode=require

# Stripe (live keys)
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_...
STRIPE_SECRET_KEY=sk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...

# Optional
GOOGLE_API_KEY=your-google-api-key
EMAIL_DELIVERY_MODE=real
RESEND_API_KEY=re_...
RESEND_FROM_EMAIL=onboarding@yourdomain.com

Getting Values

Supabase Keys

Local Development:

bunx supabase status

This outputs the auth URL and anon key.

For app data, use a local Postgres connection string for your local database.

Production:

Go to Supabase Dashboard
Navigate to Settings → API
Copy URL and anon key

Database URL

Use the connection string that matches your runtime:

Supabase Supavisor transaction pooler URL for serverless deployments
Supabase direct connection string for long-lived IPv6-capable servers
Neon connection string
Railway Postgres URL
self-hosted Postgres URL

Stripe Keys

Go to Stripe Dashboard
Copy Publishable key and Secret key
Use test keys (pk_test_, sk_test_) for development
Use live keys (pk_live_, sk_live_) for production

Stripe Webhook Secret

Local Development:

./coremvp stripe:listen

The local CLI updates .env.local with the latest webhook signing secret before it starts forwarding events.

Production:

Go to Stripe Dashboard → Webhooks
Create endpoint for https://yourdomain.com/api/webhooks/stripe
Select events to listen for
Copy the signing secret

Google API Key (Optional)

Go to Google Cloud Console
Create or select a project
Enable the Generative AI API
Create an API key

Security Notes

Rule	Reason
Never commit `.env.local`	Contains secrets
Use test keys in development	Prevents real charges
Rotate secrets periodically	Limits exposure if leaked
`NEXT_PUBLIC_*` are exposed	Only use for public data
`DATABASE_URL` is server-only	Never expose it to client code

Verifying Configuration

Check if all required variables are set:

src/lib/env.ts

const requiredVars = [
  'NEXT_PUBLIC_SUPABASE_URL',
  'NEXT_PUBLIC_SUPABASE_ANON_KEY',
  'DATABASE_URL',
  'STRIPE_SECRET_KEY',
  'STRIPE_WEBHOOK_SECRET',
];

for (const varName of requiredVars) {
  if (!process.env[varName]) {
    throw new Error(`Missing required env var: ${varName}`);
  }
}

Configuration - Setup guide
Getting Started - Clone, install, and run the template

Was this page helpful?

Environment Variables

On this page